shadowsocks / shadowsocks/shadowsocks-org
server and client should not share the same subkey
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 1k
- Forks
- 694
- PR merge metrics
- No merged PRs in 30d
Description
As client and server share the same key the same info string "ss-subinfo", secret messages of aes-gcm might be encrypted by the same key if random salt is same.
Due to random salt is visible, if some one could store several peices of communication message and wait for the time when client and server have used the same random salt. It could get some useful information from secret message.
For detailed information, please check Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS (camera-ready version / Usenix WOOT16).
All in all, make nonce unique. Subkey should be different between client and server.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or implementation entry points. Start by locating the protocol code that derives the client and server subkeys, then verify that the two directions cannot reuse the same key or nonce; done means the directional subkeys are distinct and the relevant behavior is covered by tests.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100